PT-2024-5776 · Apache+2 · Apache Zookeeper+2
周吉安
+1
·
Published
2024-03-14
·
Updated
2026-05-18
·
CVE-2024-23944
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:L/Au:S/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Apache ZooKeeper versions prior to 3.9.2
Apache ZooKeeper versions prior to 3.8.4
Description
The issue is related to information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching a persistent watcher (addWatch command) to a parent which the attacker has already access to. The ZooKeeper server doesn't do ACL check when the persistent watcher is triggered, and as a consequence, the full path of znodes that a watch event gets triggered upon is exposed to the owner of the watcher. Only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical. Approximately 83,109 devices are potentially affected, mainly distributed in China and the United States.
Recommendations
To resolve the issue, upgrade to version 3.9.2 or 3.8.4, which fixes the issue.
As a temporary workaround, consider restricting access to the
addWatch command to minimize the risk of exploitation.
Avoid using sensitive information in znode paths until the issue is resolved.Fix
Missing Authorization
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Apache Zookeeper
Debian
Red Os